Page Builder: Pagelayer – Drag and Drop website builder
pagelayer · plugin
Known security vulnerabilities for Page Builder: Pagelayer – Drag and Drop website builder. Find out in seconds which version runs on your site with WP Lens.
19 known vulnerabilities
3 exploitable without logging in · latest Jun 13, 2026
Listed on wordpress.org · latest 2.2.2 · last updated Sep 24, 2026 · 400K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 8.8
CVE-2024-30465login required≤ 1.8.1
WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability
- Medium 6.5
CVE-2025-24573login required≤ 1.9.4
WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2026-3297contributor+≤ 2.0.9
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block
- Medium 6.4
CVE-2026-2509contributor+≤ 2.0.8
Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
- Medium 6.4
CVE-2024-13427contributor+≤ 2.0.0
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link
- Medium 5.4
CVE-2024-2504contributor+≤ 1.8.4
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes
- Medium 5.4
CVE-2024-2127contributor+≤ 1.8.3
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
- Medium 5.4
CVE-2024-1590contributor+≤ 1.8.2
Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
- Medium 5.4
CVE-2023-6738contributor+≤ 1.7.8
PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields
- Medium 5.3
CVE-2026-2442unauthenticated≤ 2.0.7
Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
- Medium 4.8
CVE-2024-43972high privilege≤ 1.8.7
WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability
- Medium 4.7
CVE-2025-4223unauthenticated · needs a click≤ 2.0.0
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
- Medium 4.3
CVE-2025-1926unauthenticated · needs a click≤ 1.9.8
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
- Medium 4.3
CVE-2026-39469login required≤ 2.0.8
WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability
- Medium 4.3
CVE-2023-49196login required≤ 1.7.7
WordPress Pagelayer plugin <= 1.7.7 - Broken Access Control vulnerability
- Medium 4.3
CVE-2026-2470contributor+≤ 2.0.9
Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
- Medium 4.3
CVE-2025-12366author+≤ 2.0.5
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
- Medium 4.3
CVE-2025-2104contributor+≤ 1.9.8
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication
- Medium 4.3
CVE-2024-13430contributor+≤ 1.9.8
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).